overview:
A few months back, cybercriminals stole customers’ encrypted backups during a breach of its systems.

LastPass released official Security Incident Update and Recommended Actions to all LastPass users
https://blog.lastpass.com/2023/03/security-incident-update-recommended-actions/

 

Last App you should use


Read

 

Stop using paid online services for password storage! This is completely unnecessary as you can do this yourself, safer and 100% free:

1. Install KeePass or KeePassXC (apps exist for desktop, Android, iOS)
   
2. Think up a strong master password that you store in your head
3. Setup your password database with all your accounts and passwords
4. Save the database file on a free cloud service (such as Google Drive, or your self-hosted cloud service like Synology);
   No worries here: it's an encrypted file that is useless to hackers without the password stored in your head
5. On desktop: press ctrl+F to find an entry; press ctrl+shift+V to autotype your username/password in the last active window
   On smartphone: it will provide you with an option to select an account when you are selecting an edit box

I've been using this for years, suits me perfectly. Just saying...

 

And most of all (if possible), use a Two Factor Authentification, like SMS, email or app.

 

Combining a 2FA Key (Hardware Security Key) with a password manager like 1Password or Bitwarden are solid options as well

 

There seems to be no limit to idiocy.

But there is literally no large company that can be trusted securitywise anymore.

If security gaps are not caused by sheer stupidity, they are caused by criminal behavior.
And where does this come from?

One poInt - among others oc - is the hire & fire mentality. The employers think they can get good staff again at any time and could handle the existing staff like any other commodity.
Such "discarded" employees then sometimes come up with the idea to sell security relevant data.

A second reason is: No one (no company) wants to go through the trouble of training staff themselves anymore (yes it's costly but it's an investment that will pay out imho). They think they can poach their needs elsewhere. But who do they get: Money-hungry bastards or idiots who are no longer wanted at the competition.

 

Last edited: Mar 3, 2023

Please just use whatever Bitwarden or KeePass client / server you like best.

KeePassXC is great on Windows, KeePassium is great on Apple, KeePassDX is great on Android. (KeePassXC also works on Linux and MacOS)

Everything else is at least one of these things:
- not available on all platforms.
- not future proof because of its closed format.
- plagued with security issues.
- likely to end up turning into a subscription service.
- hacky.

 

that´s not it, LP was a VERY small startup with no SEC. competency at all.
Different to lets say Proton, or Bitwarden.
or (suspiciously) brands that do loads of advertising like nord, pia or lastpass